Upholding information rights 
l © 3rd Floor, 14 Cromac Place, Belfast, BT7 2JB 
Tel. 0303 123 1114 


Information Commissioner’s Office www.ico.org.uk 


Ms Geraldine Hamilton 

Regional Trauma Network Manager 
Health & Social Care Board 

12-22 Linenhall Street 

Belfast 

BT2 8BS 


By email: regionaltraumanetwork@hscni.net 


16 September 2019 
Dear Sir/ Madam 


Regional Trauma Network - Service Delivery Model and Equality Impact 
Assessment: Report for Consultation 


The Information Commissioner is pleased to respond to the Health and Social 
Care Board, regarding its consultation on the proposed service delivery model of 
the Regional Trauma Network. 


The Commissioner has responsibility for promoting and enforcing the EU General 
Data Protection Regulation (GDPR), the UK Data Protection Act 2018 (DPA 2018) 
and other information rights legislation. The Commissioner does not take a view 
on the proposal to create a specialised local trauma team in each Health and 
Social Care Trust or on any matter which is outside the scope of her 
responsibilities. 


We welcome the opportunity to respond to the above consultation. We note that 
the consultation does not specifically state whether or not personal data will be 
processed. It is acknowledged that some or perhaps all of the data you will 
process for the purpose of executing the proposed service delivery model will not 
involve personal data or may perhaps involve data that has been anonymised 
and would therefore not fall within the remit of the GDPR. For further 
information on what constitutes personal data and on anonymisation, please see 
Our quidance. 
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However, where you intend to process or share personal data, you should 
consider carrying out a DPIA. There is guidance available on our website on how 
to carry out a DPIA. 


Article 35(1) of the GDPR requires that a Data Protection Impact Assessment 
(DPIA) should be carried out by the controller where proposals are likely to result 
in a high risk to the rights and freedoms of individuals. The DPIA must also be 
carried out prior to the processing being undertaken. If the assessment 
highlights high risks that cannot be mitigated against, the controller must consult 
with the ICO in relation to the DPIA for the proposed processing operation. 


At para 7.4 of the Equality Impact Assessment, it is noted that several of the 
target groups are vulnerable and that ‘the Regional Trauma Network will need to 
demonstrate its accountability in relation to safeguarding, information sharing 
and governance standards. To this end, the Health and Social Care Board and its 
key partners the Health and Social Care Trusts and the Victims and Survivors 
Service will need to have available for scrutiny evidence of key policies, 
procedures and documentation.’ The examples listed include ‘data protection’, 
‘information sharing protocols’ and reference is made to staff training. Please 
note that this should also include data protection training for staff, where 
personal data is being processed. 


We note that in your Mission Statement in the Executive Summary, you refer to 
partnership working and collaboration. If it is your intention to share personal 
data as part of these arrangements, you should ensure that a data sharing 
agreement or protocol is in place. 


As you may be aware, the ICO's Data Sharing Code of Practice, which was 
prepared under the Data Protection Act 1998, has recently been revised to reflect 
the changes implemented by the new data protection framework under the GDPR 
and the Data Protection Act 2018. This code will be a statutory code for the 
purposes of Section 121 of the DPA 2018. Prior to drafting the code, the ICO 
launched a call for views in August 2018, seeking input from individuals and 
organisations. The updated draft code was recently out for consultation and 
responses closed on the 9t September 2019. Responses to the consultation are 
currently being considered before a final version is published. You might find this 
document helpful in the interim if it is indeed your intention to share personal 
data. Further details can be found here. 


Yours sincerely 
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Caroline Mooney 
Regional Manager - ICO 
Northern Ireland 
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